问题:

I've deployed a number of SSL configurations, including both Tomcat (cacerts + keytool) and IIS (Windows Certificate Store + netsh http sslcert) so I'm familiar with these procedures.

Has anyone come up with a way to point Tomcat's SSL connector to a Windows Store (i.e. configuration, extension, plugin, etc.)? Just looking to centralize management of SSL deployments to one store, vs. having multiple stores.

回答1:

It seems not possible. From tomcat 8 documentation https://tomcat.apache.org/tomcat-8.0-doc/ssl-howto.html

tomcat currently operates only on JKS, PKCS11 or PKCS12 format keystores.

Windows Store would require an specific connector similar to the 'WINDOWS-MY' of JSSE.

There is no reference in documentation to any plugin or connector to Windows Certificate Store.

回答2:

According to the answer on "SSL enabling in Tomcat Windows server" you can specify keystore type as "Windows-My" in configuration of connector in server.xml, it worked for me on Tomcat 8.0.22 as well

<Connector port="8443" 
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           SSLEnabled="true"
           maxThreads="150" 
           scheme="https" 
           secure="true"
           keyAlias="<alias of the cert>"
           keystoreFile=""
           keystoreType="Windows-My"
           clientAuth="false" 
           sslProtocol="TLS"
           keepAliveTimeout="200000" />